7 ms·

> (If anyone at Apple is reading this: ffs, allow the legitimate owner of a device to "unpair" all components in their phone in iCloud so that legitimate second

> (If anyone at Apple is reading this: ffs, allow the legitimate owner of a device to "unpair" all components in their phone in iCloud so that legitimate second-hand shops can strip a broken device at least for its parts) I was robbed at gunpoint (but not in a 'problematic' part of town) and the thief outlined all the steps he needed me to take to remove my phone from Find My and from iCloud. I think a lot of these mitigation measures could make sense but there's no perfect solution.

shortcake27 3y ago
I’m sorry that happened to you. IMHO this is a huge problem. A thief just wants to steal your phone. To ensure the value of the device, it’s now common to force you to provide your passcode. This gives access to all your data, can be used to reset your Apple ID password, lock you out of your account, and erase and lock all your other devices. This problem never existed before, and it’s significantly worse! Like, way way way worse. It’s so bad I wonder if I should really be signed into my Apple ID on my phone at all. Because I don’t give the slightest care of someone stealing my phone. But I do care if they have access to all my data, erase and lock me out of all my other devices. I really care about that. And this problem only exists because Apple locks down the device and all parts.
- PrimeMcFly 3y ago
  It sounds like the solution for your problem is not to use an Apple phone. Use an Android rom that gives you significantly more power and granularity.
  - TheHappyOddish 3y ago
    I'm unsure how your device being Android means you won't hand over the keys when prompted at gunpoint. Can you explain your line of thought?
    - PrimeMcFly 3y ago
      It's much easier on Android to setup all kinds of alternatives. You could setup a 'dummy' key that if entered would alert the police, for example. Failing that, you can setup different keys for different services with different levels of access, as well as have third party equivalents to 'Find my iPhone'. Not being in the walled garden provides a lot of freedom and flexibility to setup contingencies.
      - TheHappyOddish 3y ago
        Maybe... But ignoring the fact this lgel of customisation is unlikely for any normal and most tech people, you'd likely require root to override the core system and password auth I'd imagine. I believe this ends up invalidating what is core functionality for most people - banking, wildvine, etc. If we're moving into the realm of the ultra paranoid, high security over convenience focused user - sure. In fact I dare say such a user might prefer a Linux phone with physical keyboard, or no phone at all. But if we're talking average iPhone or Android users here, I can't imagine the scenario would change much at gunpoint.
        PrimeMcFly 3y ago
        > But ignoring the fact this lgel of customisation is unlikely for any normal and most tech people, This is HN though...surely there are a lot of people who care about security and have experience using custom roms. > you'd likely require root to override the core system and password auth I'd imagine Honestly, even a simple solution would be putting on something like Prey, which is free and easy to use, and using a third party applocker tool. Those two things don't need a custom rom or any other customization.
- Bud 3y ago
  [dead]
- jwells89 3y ago
  > And this problem only exists because Apple locks down the device and all parts. It would likely be a problem even without the lockdowns and official parts flowing freely, because even if Apple is selling the parts with zero margin, black market and gray market parts supplied from stolen devices are still going to be cheaper, which means there will still be a demand for them from unscrupulous repair shops that use cheap parts of questionable origin to gain an upper leg on shops playing by the rules. There will also always be individuals doing DIY repairs who won’t care where parts come from so long as they’re cheap.
- lazycouchpotato 3y ago
  They don't need to force anyone to do anything. They can just shoulder surf you entering your PIN. https://www.youtube.com/watch?v=QUYODQB_2wQ https://www.youtube.com/watch?v=QUYODQB_2wQ
danaris 3y ago
There's a significant difference in risk in robbing someone at gunpoint vs just slipping their phone out of their pocket. It's awful that that happened to you, but it's important to realize that just because a specific security measure could not prevent what happened to you, that doesn't mean it's wholly ineffectual or not worth having.
- ejstronge 3y ago
  > , but it's important to realize that just because a specific security measure could not prevent what happened to you, that doesn't mean it's wholly ineffectual or not worth having. I think you are missing the point of the comment. The GP says that Apple should allow parts to be unpaired to allow re-use of components; this example suggests that there is utility to keeping the existing security system.
Spivak 3y ago
I mean the perfect solution (from a theft perspective) would just be only allowing Apple to remove the phone from your iCloud account at a physical location when presented with ID. Annoying for people selling their phone, sure. But that plus the hardware paring would make it functionally worthless to anyone but you.
- Dylan16807 3y ago
  You can add a delay.
Joeri 3y ago
Unpairing a device from icloud should probably require a second factor or a mandatory safety wait period. Same for every potentially really harmful action.
LorenPechtel 3y ago
Apple should have a duress system. You have say 48 hours to contact Apple and tell them the change was made under duress--and you do so with the *old* credentials, not the new ones. All changes to your account revert and the phone locks itself to your account once it sees the network.
- withinboredom 3y ago
  People would instantly use this for insurance fraud.
  - LorenPechtel 3y ago
    Legitimate buyer would file a police report for fraud.

shortcake27 3y ago

I’m sorry that happened to you. IMHO this is a huge problem. A thief just wants to steal your phone. To ensure the value of the device, it’s now common to force you to provide your passcode. This gives access to all your data, can be used to reset your Apple ID password, lock you out of your account, and erase and lock all your other devices. This problem never existed before, and it’s significantly worse! Like, way way way worse. It’s so bad I wonder if I should really be signed into my Apple ID on my phone at all. Because I don’t give the slightest care of someone stealing my phone. But I do care if they have access to all my data, erase and lock me out of all my other devices. I really care about that. And this problem only exists because Apple locks down the device and all parts.

PrimeMcFly 3y ago
It sounds like the solution for your problem is not to use an Apple phone. Use an Android rom that gives you significantly more power and granularity.
- TheHappyOddish 3y ago
  I'm unsure how your device being Android means you won't hand over the keys when prompted at gunpoint. Can you explain your line of thought?
  - PrimeMcFly 3y ago
    It's much easier on Android to setup all kinds of alternatives. You could setup a 'dummy' key that if entered would alert the police, for example. Failing that, you can setup different keys for different services with different levels of access, as well as have third party equivalents to 'Find my iPhone'. Not being in the walled garden provides a lot of freedom and flexibility to setup contingencies.
    - TheHappyOddish 3y ago
      Maybe... But ignoring the fact this lgel of customisation is unlikely for any normal and most tech people, you'd likely require root to override the core system and password auth I'd imagine. I believe this ends up invalidating what is core functionality for most people - banking, wildvine, etc. If we're moving into the realm of the ultra paranoid, high security over convenience focused user - sure. In fact I dare say such a user might prefer a Linux phone with physical keyboard, or no phone at all. But if we're talking average iPhone or Android users here, I can't imagine the scenario would change much at gunpoint.
      - PrimeMcFly 3y ago
        > But ignoring the fact this lgel of customisation is unlikely for any normal and most tech people, This is HN though...surely there are a lot of people who care about security and have experience using custom roms. > you'd likely require root to override the core system and password auth I'd imagine Honestly, even a simple solution would be putting on something like Prey, which is free and easy to use, and using a third party applocker tool. Those two things don't need a custom rom or any other customization.
Bud 3y ago
[dead]
jwells89 3y ago
> And this problem only exists because Apple locks down the device and all parts. It would likely be a problem even without the lockdowns and official parts flowing freely, because even if Apple is selling the parts with zero margin, black market and gray market parts supplied from stolen devices are still going to be cheaper, which means there will still be a demand for them from unscrupulous repair shops that use cheap parts of questionable origin to gain an upper leg on shops playing by the rules. There will also always be individuals doing DIY repairs who won’t care where parts come from so long as they’re cheap.
lazycouchpotato 3y ago
They don't need to force anyone to do anything. They can just shoulder surf you entering your PIN. https://www.youtube.com/watch?v=QUYODQB_2wQ https://www.youtube.com/watch?v=QUYODQB_2wQ

danaris 3y ago

There's a significant difference in risk in robbing someone at gunpoint vs just slipping their phone out of their pocket. It's awful that that happened to you, but it's important to realize that just because a specific security measure could not prevent what happened to you, that doesn't mean it's wholly ineffectual or not worth having.

ejstronge 3y ago
> , but it's important to realize that just because a specific security measure could not prevent what happened to you, that doesn't mean it's wholly ineffectual or not worth having. I think you are missing the point of the comment. The GP says that Apple should allow parts to be unpaired to allow re-use of components; this example suggests that there is utility to keeping the existing security system.

Spivak 3y ago

I mean the perfect solution (from a theft perspective) would just be only allowing Apple to remove the phone from your iCloud account at a physical location when presented with ID. Annoying for people selling their phone, sure. But that plus the hardware paring would make it functionally worthless to anyone but you.

Dylan16807 3y ago
You can add a delay.

Joeri 3y ago

Unpairing a device from icloud should probably require a second factor or a mandatory safety wait period. Same for every potentially really harmful action.

LorenPechtel 3y ago

Apple should have a duress system. You have say 48 hours to contact Apple and tell them the change was made under duress--and you do so with the *old* credentials, not the new ones. All changes to your account revert and the phone locks itself to your account once it sees the network.

withinboredom 3y ago
People would instantly use this for insurance fraud.
- LorenPechtel 3y ago
  Legitimate buyer would file a police report for fraud.